pg_reports 0.8.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2800846cf0c02bdf3a2605151d0bfe7b7775a1eda3a1a920eed26bc3f731748d
-  data.tar.gz: 6f07d07fcd9e396d6c9dd885f9e9c2e0c9d10595f5b8817eba59a2c8c734981a
+  metadata.gz: 8a307810bc4ac9d34917eddd4d3a231a4a9fd0010f2b8bd1d1f56a654336028b
+  data.tar.gz: 175e0568589ca06b81a7482550d6eb1e3bfe05089ea1fda74b47fc33901aa4d0
 SHA512:
-  metadata.gz: 2c5165e3eaff390afb0f9369aa6a9a2351dbe410cf64fd26a5df0be6cd3492513d0510d84758886dfa42d04b378e524d8483490f991ab63f3cef25ed8594b088
-  data.tar.gz: 312d69fcb4a15c0216a1381ec04d9db6bf4811b326b89e70ecd5ce5ed43974eddc38ab6ed3c59e7358eb4ce2e1f0fd7ffc054be0da747f3d903f40b808e205c1
+  metadata.gz: 2f817ec173d59b77e7a70ec69b15292bd9a7eb9e074d7c5edd1cd82003f76bd382efdecc754313a453e5f851d3c1bd5c447cf6bd29723afae49110f49e95631e
+  data.tar.gz: 7188d4caa875624d210c4b00fbd4d3e3046b0df7bce877b5484d3ebad919d8a19df908e6c923fe2f48ac62e0595cfa5a48699accfccfc5c4cb4bc603e9dba5db

data/CHANGELOG.md

@@ -7,6 +7,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-09-16
+
+### Changed
+- **The CI matrix now resolves against committed lockfiles.** `gemfiles/*.gemfile.lock` were gitignored, so every matrix job re-resolved dependencies from scratch and drifted with whatever was newest on the day — which is how the Rails 6.1 job silently moved onto a json 3.x that ActiveSupport 6.1 cannot use, turning green builds red with no code change. Each lockfile is generated with that entry's own Ruby and pinned to the runner's `x86_64-linux` platform. The Rails 6.1 lockfile deliberately pins json 3.0.2, so the incompatibility that started this stays covered rather than being pinned away.
+- **Updated `json`, `loofah` and `rails-html-sanitizer`** in the root lockfile to clear open advisories (`bundler-audit`).
+- **Dashboard visual overhaul — a single design system instead of three drifting stylesheets.** The three `<style>` blocks (layout, `index`, `_show_styles`) had grown independent, conflicting copies of the same components: `.modal-close` was 28px in one and 32px in another, `.modal-small` was 360px and 420px, `.toast` and the whole `.btn` family were defined twice with different colours, and `.explain-stats` / `.explain-result` were each declared twice within one file. All shared components now live once in the layout, and the per-page blocks only hold what is genuinely page-specific. `_show_styles.html.erb` shrank from 1678 to ~1500 lines with no loss of coverage.
+  - **Design tokens.** New `:root` tokens for radii (`--radius-sm`/`--radius`/`--radius-lg`), control height, shadows, fonts, and an accent-tint scale (`--amber-soft`/`--amber-line`, …) derived from the actual `--accent-*` values. Every hard-coded `rgba()`/hex tint was replaced — many were leftover Tailwind-palette values (`#ef4444`, `rgba(59,130,246,…)`) that no longer matched the accent they bordered.
+  - **Fixed two undeclared variables.** `--text-tertiary` and `--accent-red` were referenced but never defined, so those rules silently fell back to inherited colour; both are now declared. Removed the unused `--accent-indigo`, `--gradient-start` and `--gradient-end`.
+- **Buttons are solid, classic controls.** `.btn-primary` was a translucent tinted outline (`rgba(124,138,246,.14)` fill, accent text, accent border); it is now a filled button with white text, plus proper `:active` and `:focus-visible` states. `.btn-secondary`/`.btn-danger`/`.btn-muted`/`.btn-ghost`/`.btn-icon` share one height, radius and transition, and every variant is declared in exactly one place.
+- **Status is no longer signalled by coloured left stripes.** The live metric cards carried a 3px green/amber/rose `border-left` — "healthy" was as decorated as "critical". Status now reads from the corner dot, the value colour and the sparkline, with the card's own border tinting only for warning and critical. The same treatment replaced the coloured rails and `linear-gradient` washes on EXPLAIN summary cards, problem cards and stat tiles.
+  - Table problem rows used `border-left` on `<tr>`, which does not render under `border-collapse: collapse`; they now use an inset shadow on the first cell, so the marker is actually visible.
+- **Sparkline colour encodes state, not identity.** Each metric drew its trend in its own hue (blue/green/purple/amber/rose), which read as decoration. All five now draw in a muted neutral, switching to amber or rose only when that metric crosses its threshold.
+- **Emoji replaced with an inline SVG icon sprite.** Emoji were used as UI icons throughout — the header logo tile, category and metric icons, the settings gear, lock, play/pause, and as prefixes baked into ~48 locale strings per language (`"📋 Copy"`, `"⬇ Export"`, `"🔒 Requires pg_stat_statements"`). They rendered differently on every OS and could not be coloured. All are now stroke-drawn `<symbol>`s defined once in the layout and referenced with `<use>`, inheriting colour and size from their context. Locale strings carry text only.
+- **Removed the header logo tile.** The wordmark and version carry the branding.
+- **Dropped the decorative motion.** Hover lifts (`translateY(-1px/-2px)`, `translateX(4px)` plus shadow), the glassmorphism `backdrop-filter: blur()` on modals, and the pulsing animation on the static status-badge dot are gone. Non-interactive panels no longer light up in accent purple on hover.
+- **Typography.** Plus Jakarta Sans → Inter, body line-height 1.6 → 1.5, and a consistent type scale for a dense dashboard. Numeric surfaces (result tables, live metric values, EXPLAIN stats) use `tabular-nums` so digits stop reflowing as values refresh.
+- **Accessibility.** Added `:focus-visible` rings on buttons, inputs and textareas; icon-only buttons carry `aria-label`; decorative icons are `aria-hidden`.
+- **Source locations in `.rake`, `.jbuilder`, `config.ru` and extensionless files were not recognised at all.** The client-side parser matched paths against a hardcoded extension allow-list (`rb|erb|js|ts|py|go|java`); anything outside it fell through unparsed, which silently cost it the root-stripping, the start-clipping *and* its IDE link — a `/lib/tasks/setup.rake:17` rendered as the raw absolute path, home directory included. The allow-list is gone: the matcher now takes any path followed by `:<line>`, which also fixes Windows paths (`C:\app\models\post.rb:12`) that the old `[^:]+` broke on at the drive letter. Sources that still don't parse (`PostsController#index`) are clipped from the start too, instead of having their tail cut off.
+- **Source locations are shown short, and never truncated where it matters.** The badge used to print the path verbatim and clip it with `text-overflow: ellipsis` — which cuts the *end*, throwing away the file name and line and leaving only a long shared prefix. It now strips the host application's root (when the engine is mounted in one), collapses a bundled gem's install prefix to the gem's own directory (`…/lib/ruby/gems/3.4.0/gems/activerecord-8.1.3/lib/…` → `activerecord-8.1.3/lib/…`), and clips what remains from the *start*, so the line number is the last thing to go: the directory is given up first and almost entirely, and only once there is no directory left does the file name itself start losing leading characters. The badge is capped at its cell's width and clips its own overflow, so a single long unbreakable file name can no longer push the badge past the column. The directory is dimmed, the file and line are not. Standalone mode has no host-app root to strip, so it gets the gem collapse and the start-clipping. The full path is unchanged in the tooltip, the expanded row and the exports, and IDE links are still built from it.
+- **"Load History (50)" is now "Load History", and is disabled when there is nothing to load.** The number was the request's page size, not a count of anything the user had; read as "50 entries are waiting". The button is also enabled only when history is actually retrievable — it reads from `config.query_monitor_log_file`, so with no log file configured (or none written yet) it could only ever no-op. `QueryMonitor#status` now reports `history_available`, and the disabled button explains why in its tooltip.
+- **The report page's "Back" button moved into the breadcrumb.** It sat at the far right of the action row — away from the navigation context, and a second control doing what the "Dashboard" crumb already did. The first crumb is now the back action, with a left-arrow icon making the affordance explicit.
+- **One vertical rhythm for text and code blocks.** The global `* { margin: 0 }` reset leaves prose containers with no spacing of their own, and the per-element margins that filled the gap had drifted into asymmetry — a `<pre>` inherited 1rem above (from the preceding `<p>`'s `margin-bottom`) and 0 below, so snippets floated away from their intro line and collided with the line under them. Spacing is now owned by one `> * + *` rule per container, driven by a `--flow-gap` token, with the ad-hoc `margin-bottom`/`margin-top` on each block removed.
+- **One code-block definition.** The same "here is how to enable this feature" panel existed in five hand-spaced copies (`<br><br>` for paragraph breaks, `&nbsp;&nbsp;` for indentation, inline `style=` for the box) across the SQL Console, EXPLAIN, Execute Query and migration flows. All five now render through a shared `pgReportsDisabledNotice()` helper using a real `<pre class="code-block">`, so indentation is actual whitespace and every snippet in the UI is styled identically.
+- **One field-label definition.** `.explain-label`, `.explain-stat-label`, `.row-detail-label`, `.problem-field-label`, `.saved-record-field-name` and `.saved-record-detail-label` were six variants of "small-caps label above a value", spread across 0.65–0.8rem, three letter-spacings and two colours. Collapsed into a single rule.
+
+### Fixed
+- **The dashboard broke out of the viewport on a phone.** The `@media (max-width: 768px)` block covered the container, the header and the report actions, and nothing else, so everything added since was laid out at desktop proportions: the breadcrumb squeezed the database selector down to a few characters, the results header packed its title and three meta items into one unwrappable row, filter labels fought their inputs for the same line, and the `.btn { flex: 1 }` in that block stretched *every* button on the page — including "Clear All", which then overran the "Saved for Comparison" title next to it. Two things pushed the page itself sideways: the Query Monitor's scope tooltip (a 320px absolutely-positioned `::after` anchored mid-row, which widened the layout viewport and dragged the fixed toast with it), and the toast's own `max-width: 26rem`, wider than the screen and pinned by `right`. The expanded-row detail was the worst of it — a two-column grid inside the horizontally scrolling results table, with its second column parked off-screen. It is now one column, pinned to the viewport with `position: sticky` so it stays readable while the table scrolls sideways under it; the generic cell rule's `overflow: hidden`, which made the cell its own scroll container and killed the sticky, is lifted for that one cell. The tooltip becomes a bottom sheet, the toast spans the screen width, and the button stretch is scoped to the page's actual action bars. Verified at 320/360/390/414/768px across the dashboard and five report pages: no page-level horizontal overflow anywhere, with only the results table scrolling sideways as intended.
+- **The proxy scrollbar above a wide results table was dead space on touch.** It renders a 12px strip whose only purpose is to be dragged, and touch devices draw no scrollbar in it; it is now skipped when the pointer is coarse, where the table is dragged directly anyway.
+- **Query-monitor file logging silently wrote nothing on Rails <= 7.0 with json >= 3.** The writer serialized with `#to_json`, which ActiveSupport overrides and (up to Rails 7.0) calls with json's `quirks_mode` option — removed in json 3, so it raises `ArgumentError: unknown keyword: quirks_mode`. The writer's `rescue` swallowed that by design ("don't break monitoring if the file write fails"), so the log file just stayed empty with no visible error. Serialization now goes through `JSON.generate`, json's own generator, which takes no such option. Covered by a regression spec.
+
+
+- **Migration-disabled toast was hardcoded Russian** in an otherwise fully translated UI. Now goes through `errors.migration_disabled_toast` (added to all three locales).
+- **Migration-disabled panel title was hardcoded English.** Now goes through `modals.migration_disabled_title` (added to all three locales).
+- **Switching to a database without pg_stat_statements leaked `PG::UndefinedTable` into the UI.** The extension is created per-database, but the availability gate lived only in the dashboard template (`category_key == :queries && !@pg_stat_status[:ready]`). `show`, `run`, `download` and `send_to_telegram` never consulted it, so opening a Queries report and then switching the database ran the report anyway and rendered the driver's `relation "pg_stat_statements" does not exist LINE 11:` in the error banner. The requirement is now declared on the category (`requires: :pg_stat_statements`) and enforced in `#category_disabled_reason`, which every entry point already calls — the dashboard template now reads that same value instead of repeating the rule. The message distinguishes the two remedies: an extension that was never created here, versus one that exists but is missing from `shared_preload_libraries`. An unreachable database is left to the existing connection-error banner rather than being mislabelled as a missing extension.
+- **Redirects out of an unavailable report were silent.** `show` has always redirected to the dashboard with `alert:` when a category is unavailable, but no view rendered `flash`, so the user was bounced with no explanation. The layout now renders `flash[:alert]` / `flash[:notice]`.
+- **`ErrorTranslator` handles missing relations and functions** (`42P01`, `42883`). When the missing relation is one an extension provides, it names the extension and hints the `CREATE EXTENSION` instead of echoing the raw driver message. The three report endpoints route failures through the translator; the raw-SQL endpoints (SQL Console, Execute Query, EXPLAIN) still return PostgreSQL's own wording, which is what you want for a query you typed yourself.
+- `ExplainAnalyzer` no longer emits a `status_icon` emoji from the analysis layer; the dashboard picks the icon from `status`.
+
 ## [0.8.2] - 2026-07-10
 
 ### Added

data/app/controllers/pg_reports/dashboard_controller.rb

@@ -26,7 +26,7 @@ module PgReports
     helper_method :category_disabled_reason, :category_disabled?
 
     def index
-      @pg_stat_status = PgReports.pg_stat_statements_status
+      @pg_stat_status = pg_stat_status
       @current_database = PgReports.system.current_database
     end
 
@@ -140,7 +140,7 @@ module PgReports
 
       @report = execute_report(@category, @report_key)
     rescue => e
-      @error = e.message
+      @error = report_error_message(e)
       @report = nil
     end
 
@@ -181,7 +181,7 @@ module PgReports
         problem_explanations: problem_explanations
       }
     rescue => e
-      render json: {success: false, error: e.message}, status: :unprocessable_entity
+      render json: {success: false, error: report_error_message(e)}, status: :unprocessable_entity
     end
 
     def send_to_telegram
@@ -198,7 +198,7 @@ module PgReports
 
       render json: {success: true, message: I18n.t("pg_reports.ui.success.telegram_sent")}
     rescue => e
-      render json: {success: false, error: e.message}, status: :unprocessable_entity
+      render json: {success: false, error: report_error_message(e)}, status: :unprocessable_entity
     end
 
     def download
@@ -227,7 +227,7 @@ module PgReports
           disposition: "attachment"
       end
     rescue => e
-      render json: {success: false, error: e.message}, status: :unprocessable_entity
+      render json: {success: false, error: report_error_message(e)}, status: :unprocessable_entity
     end
 
     def explain_analyze
@@ -536,7 +536,8 @@ module PgReports
         success: true,
         enabled: status[:enabled],
         session_id: status[:session_id],
-        query_count: status[:query_count]
+        query_count: status[:query_count],
+        history_available: status[:history_available]
       }
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
@@ -752,6 +753,18 @@ module PgReports
     # otherwise a localized string explaining why it is disabled. Exposed to
     # views via helper_method.
     def category_disabled_reason(category)
+      # pg_stat_statements is created per-database. A category that reads it is
+      # available on one database in the cluster and missing on the next, so the
+      # check belongs here — where every entry point (show, run, download,
+      # telegram) already asks — rather than in the dashboard template alone.
+      # Only meaningful once we know the connection itself works: an unreachable
+      # database has its own banner and must not be reported as a missing
+      # extension.
+      if Dashboard::ReportsRegistry.requires(category) == :pg_stat_statements &&
+          pg_stat_status[:connected] && !pg_stat_status[:ready]
+        return pg_stat_unavailable_reason
+      end
+
       constraint = Dashboard::ReportsRegistry.target_constraint(category)
       return nil unless constraint == :primary_default_database_only
 
@@ -777,6 +790,44 @@ module PgReports
       category_disabled_reason(category).present?
     end
 
+    # A report failing because the selected database lacks an extension-provided
+    # relation is the common case here (extensions are per-database, the
+    # dashboard's database picker is not), and "PG::UndefinedTable: ERROR:
+    # relation ... does not exist LINE 11:" is not something to show a user.
+    def report_error_message(error)
+      info = Connection::ErrorTranslator.translate(error)
+      [info[:detail], info[:hint]].reject { |part| part.to_s.strip.empty? }.join(" ")
+    rescue
+      error.message
+    end
+
+    # Scoped to the request's selected database by the surrounding
+    # #within_selected_database, and memoized because the dashboard asks once
+    # per category while rendering the grid.
+    def pg_stat_status
+      @pg_stat_status ||= PgReports.pg_stat_statements_status
+    end
+
+    # The two failure modes need different remedies: an extension that was never
+    # created here can be created, one that isn't preloaded needs a restart.
+    def pg_stat_unavailable_reason
+      database = @selected_database.presence || PgReports.system.current_database
+
+      if pg_stat_status[:extension_installed]
+        I18n.t("pg_reports.ui.categories.pg_stat_not_preloaded_reason",
+          database: database,
+          default: "Requires pg_stat_statements. The extension exists on " \
+            "\"%{database}\" but is not in shared_preload_libraries, so it " \
+            "returns no data until PostgreSQL is restarted with it preloaded.")
+      else
+        I18n.t("pg_reports.ui.categories.pg_stat_missing_reason",
+          database: database,
+          default: "Requires pg_stat_statements, which is not installed on " \
+            "\"%{database}\". Create the extension there, or switch to a " \
+            "database that has it.")
+      end
+    end
+
     # SQL Query Monitor taps ActiveSupport::Notifications in the host
     # application's process. In standalone mode there is no host app — pg_reports
     # is the only process running, so there's nothing meaningful to observe.